snapshot: fetch credentials from EC2IMDS

internal/snapshot/snapshotter.go

@@ -12,11 +12,11 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/rs/zerolog"
 	runsOnConfig "github.com/runs-on/snapshot/internal/config"
+	"github.com/runs-on/snapshot/internal/utils"
 )
 
 const (
@@ -96,7 +96,7 @@ type VolumeInfo struct {
 // NewAWSSnapshotter creates a new AWSSnapshotter instance.
 // It initializes the AWS SDK configuration and fetches EC2 instance metadata.
 func NewAWSSnapshotter(ctx context.Context, logger *zerolog.Logger, cfg *runsOnConfig.Config) (*AWSSnapshotter, error) {
-	awsConfig, err := config.LoadDefaultConfig(ctx)
+	awsConfig, err := utils.GetAWSClientFromEC2IMDS(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load AWS SDK config: %w", err)
 	}
@@ -141,7 +141,7 @@ func NewAWSSnapshotter(ctx context.Context, logger *zerolog.Logger, cfg *runsOnC
 	return &AWSSnapshotter{
 		logger:    logger,
 		config:    cfg,
-		ec2Client: ec2.NewFromConfig(awsConfig),
+		ec2Client: ec2.NewFromConfig(*awsConfig),
 	}, nil
 }
 

internal/utils/helpers.go

@@ -1,8 +1,15 @@
 package utils
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"os"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
+	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
 )
 
 func PrettyPrint(v interface{}) string {
@@ -12,3 +19,20 @@ func PrettyPrint(v interface{}) string {
 	}
 	return string(b)
 }
+
+// GetAWSClientFromEC2IMDS retrieves AWS config from EC2 IMDS,
+// ignoring any local AWS config (e.g. ~/.aws) and ENV variables.
+//
+// This ensures that we always assume RunsOn instance profile IAM role, regardless of what happens in other GHA actions/steps.
+func GetAWSClientFromEC2IMDS(context context.Context) (*aws.Config, error) {
+	provider := ec2rolecreds.New(func(o *ec2rolecreds.Options) {
+		o.Client = imds.New(imds.Options{})
+	})
+
+	cfg, err := config.LoadDefaultConfig(context, config.WithRegion(os.Getenv("RUNS_ON_AWS_REGION")), config.WithCredentialsProvider(aws.NewCredentialsCache(provider)))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+	}
+
+	return &cfg, nil
+}